Pass a select with mysqli_fetch_row to a table

Question

I have a problem with passing the query that returns a number of records, I already have it with a select that returns an input, but this only works with one record, but more than one needs to be shown, so everything that the query brings me I need to put it in a table.

<?php 
$conexion=mysqli_connect('localhost','root','mysql','venta3');
$continente=$_POST['continente'];

    $sql1="SELECT cobro, debe,idEntrega FROM inventario Where (idCliente='$continente'AND (cantidadP>0 or cantidadM>0 OR cantidadG>0))";

    $result2=mysqli_query($conexion,$sql1);
    $cadena2="<select id='cobroDebe' name='cobroDebe' style='width:400px;'  class='chosen-choices2'>";

    while ($ver2=mysqli_fetch_row($result2)) {
        $cadena2=$cadena2."<option value='".utf8_encode($ver2[1])."'>".utf8_encode($ver2[1])."</option>";       
    }
    echo  $cadena2."</select>";
    
    $result1=mysqli_query($conexion,$sql1);
    $cadena1="<select id='cobroEntre' name='cobroEntre' style='width:400px;'  class='chosen-choices2'>";

    while ($ver1=mysqli_fetch_row($result1)) {
        $cadena1=$cadena1."<option value='".utf8_encode($ver1[0])."'>".utf8_encode($ver1[0])."</option>";       
    }
    echo  $cadena1."</select>";
    
    
    $result3=mysqli_query($conexion,$sql1);
    $cadena3=" ";

    while ($ver3=mysqli_fetch_row($result3)) {
        $cadena3=$cadena3."<input type='hidden' id='idEntrega' name='idEntrega'
            value='".utf8_encode($ver3[2])."'>";
            }

    echo  $cadena3;
     ?>

For security, please change your select query to parameterized prepared statement. — Ken Lee, Apr 29 '22 at 00:38
Instead of repeating the query, I recommend you put all the results in arrays. Then you can loop through each array when creating the selects. And if you want to repeat this in a table, you can just put all of that in another loop that creates each row. — Barmar, Apr 29 '22 at 00:42
**Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) — Dharman, Apr 29 '22 at 10:49
Why are you using the dreadful `utf8_encode`? Remove that function as most likely you used it in error — Dharman, Apr 29 '22 at 10:50

score 0 · Accepted Answer · answered May 09 '22 at 13:54

I am not going to write the whole solution for you but i will show you how to make the first select populate safely from the DB and seeing and learning from this you can do the rest.

$conexion=mysqli_connect('localhost','root','mysql','venta3');
$continente=$_POST['continente'];
    // Build the query with ? to prepare later
    $sql1="SELECT cobro, debe,idEntrega FROM inventario Where (idCliente=? AND (cantidadP>0 or cantidadM>0 OR cantidadG>0))";
    // Prepare the statement
    $stmt = $conexion->prepare($sql1);
    // Bind the params
    $stmt->bind_param("s", $continente);
    // Attempt to execute
    if ($stmt->execute()) {
        // if successful, get result
        $result = $stmt->get_result();
        // If query brought any rows
        if ($result->num_rows > 0) {
            // build the select
            $cadena2="<select id='cobroDebe' name='cobroDebe' style='width:400px;'  class='chosen-choices2'>";
            // Fetch assoc array from the result
            while ($ver2 = $result->fetch_assoc()) {
                // use it
                $cadena2=$cadena2."<option value='". $ver2[1] ."'>". $ver2[1] ."</option>";
            }
            echo  $cadena2."</select>";
        }
    // if execution failed - echo the error
    } else {
        echo $stmt->error;
    }
    // free result and close statement
    $result->free_result();
    $stmt->close();
    // You can reuse $stmt and $result because we've now freed them

Pay attention to the while loop $ver2[1] might not bring you any info. You have to see what is being returned by your db. I'd use something like $ver2['cobro'], $ver2['debe'], $ver2['idEntrega']

Pass a select with mysqli_fetch_row to a table

1 Answers1